I. Field
The present invention relates generally to credential systems, and more particularly, to methods and apparatus for providing application credentials to applications running on a device for the purpose of authentication and security.
II. Description of the Related Art
Advances in technology have resulted in the development and deployment of extensive data networks. These networks include both public data networks, such as the Internet, and specialized networks, such as wireless telecommunication networks. Users of these networks have the ability to access a wide variety of information and services that are available as network resources.
One example where there is an increasing demand for network resources is in wireless network environments. In wireless environments, a variety of wireless devices, such as wireless telephones, personal digital assistants (PDAs), and paging devices, communicate over a wireless network. The wireless network may also include network servers that operate to provide various network resources to the wireless devices. Furthermore, the wireless networks may also be coupled to a public network, such as the Internet, so that resources on the public network can be made available to the wireless devices on the wireless network.
Typically, a wireless device may download an application program from a wireless network. The application may be downloaded for free or purchased by the user of the wireless device, who effectively obtains the rights to use the application or content for an unlimited, fixed, or usage count based expiration period. During execution, the application may attempt to retrieve proprietary data from a data server. For example, the application may be a news retrieval application, and during operation, the application requests news data from a proprietary news data server. Before transmitting the data, the data server needs to verify that the application is authorized to receive the data. It is therefore necessary for the application to authenticate to the data server.
However, strong authentication is not possible unless there is a secret shared between the device and the server that is different for every device. If that is not the case, reverse engineering of the application will reveal enough information to gain access to the server. The shared secret should be distributed out of band, and not over the network connection between the device and the server. One approach is to provision a separate key into every device at the time of manufacture or sale. This is how some systems operate to authenticate voice calls. However, this technique does not scale to large numbers of applications, doesn't work for applications that are downloaded after purchase of the device, and application vendors may not have access to the manufacturing or sales process.
Another technique is to issue separate passwords to the each device user where the passwords are distributed using voice mail, email, paper mail, or some other out of band means. This may provide a partial solution, however, this techniques results in more user responsibility, more overhead for the application or content developer, and the requirement to create, distribute, and maintain passwords for every application used by every user.
Therefore, what is needed is a system to provide application credentials that can be used by applications running on a device to authenticate their requests for data from proprietary data servers, where the application credentials provide strong authentication without the need to have multiple passwords for every device.